Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\IKE AuthIP Spooler Certificate] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\IKE AuthIP Spooler Certificate] 'ImagePath' = 'C:\flppijj\rapxtcg.exe'
Creates the following services
- 'IKE AuthIP Spooler Certificate' C:\flppijj\rapxtcg.exe
Modifies file system
Creates the following files
- %WINDIR%\flppijj\peksgq
- C:\flppijj\peksgq
- C:\flppijj\kikhnstkkbrjpwxz5tl.exe
- C:\flppijj\rapxtcg.exe
- C:\flppijj\yocxvxpayw.exe
Sets the 'hidden' attribute to the following files
- C:\flppijj\rapxtcg.exe
- C:\flppijj\yocxvxpayw.exe
Deletes the following files
- %WINDIR%\flppijj\peksgq
- C:\flppijj\kikhnstkkbrjpwxz5tl.exe
Substitutes the following files
- %WINDIR%\flppijj\peksgq
Network activity
Connects to
- 'se####lproblem.net':80
- 'si####silver.net':80
- 'mo####invalley.net':80
- 'le###sister.net':80
- 'sw###sister.net':80
- 'sw###valley.net':80
- 'po####lebring.net':80
- 'se####station.net':80
TCP
HTTP GET requests
- http://se####lproblem.net/index.php
- http://si####silver.net/index.php
- http://mo####invalley.net/index.php
- http://le###sister.net/index.php
- http://sw###sister.net/index.php
- http://sw###valley.net/index.php
- http://po####lebring.net/index.php
- http://se####station.net/index.php
UDP
- DNS ASK ma####alescape.net
- DNS ASK wi####demand.net
- DNS ASK pe####sdemand.net
- DNS ASK wi####listen.net
- DNS ASK pe####slisten.net
- DNS ASK wi###wbring.net
- DNS ASK pe####sbring.net
- DNS ASK po####leshout.net
- DNS ASK mo####inshout.net
- DNS ASK po####ledemand.net
- DNS ASK mo####indemand.net
- DNS ASK po####lelisten.net
- DNS ASK mo####inlisten.net
- DNS ASK po####lebring.net
- DNS ASK mo####inbring.net
- DNS ASK si###eshout.net
- DNS ASK wi###wshout.net
- DNS ASK mo####demand.net
- DNS ASK si####demand.net
- DNS ASK mo####listen.net
- DNS ASK si####listen.net
- DNS ASK mo###rbring.net
- DNS ASK si###ebring.net
- DNS ASK la###shout.net
- DNS ASK se###ashout.net
- DNS ASK la###demand.net
- DNS ASK se####demand.net
- DNS ASK la###listen.net
- DNS ASK se####listen.net
- DNS ASK la###bring.net
- DNS ASK mo###rshout.net
- DNS ASK le###valley.net
- DNS ASK wi###rbring.net
- DNS ASK la####tation.net
- DNS ASK se####station.net
- DNS ASK ma####alshout.net
- DNS ASK se####lshout.net
- DNS ASK ma####aldemand.net
- DNS ASK se####ldemand.net
- DNS ASK ma####allisten.net
- DNS ASK se####llisten.net
- DNS ASK ma####albring.net
- DNS ASK se####lbring.net
- DNS ASK pr####lyshout.net
- DNS ASK sw###shout.net
- DNS ASK pr####lydemand.net
- DNS ASK sw###demand.net
- DNS ASK se###abring.net
- DNS ASK pe####sshout.net
- DNS ASK pr####lybring.net
- DNS ASK sw###bring.net
- DNS ASK le###shout.net
- DNS ASK fi###hshout.net
- DNS ASK le###demand.net
- DNS ASK fi####demand.net
- DNS ASK le###listen.net
- DNS ASK fi####listen.net
- DNS ASK le###bring.net
- DNS ASK fi###hbring.net
- DNS ASK su####tshout.net
- DNS ASK wi###rshout.net
- DNS ASK su####tdemand.net
- DNS ASK su####tlisten.net
- DNS ASK sw###listen.net
- DNS ASK su####tbring.net
- DNS ASK ma####allabor.net
- DNS ASK se####llabor.net
- DNS ASK ma####alvalley.net
- DNS ASK si####silver.net
- DNS ASK mo####inlabor.net
- DNS ASK po####levalley.net
- DNS ASK mo####invalley.net
- DNS ASK po####lesister.net
- DNS ASK mo####insister.net
- DNS ASK po####lesilver.net
- DNS ASK mo####insilver.net
- DNS ASK mo###rlabor.net
- DNS ASK si###elabor.net
- DNS ASK mo####valley.net
- DNS ASK si####valley.net
- DNS ASK mo####sister.net
- DNS ASK si####sister.net
- DNS ASK se###athird.net
- DNS ASK pe####ssilver.net
- DNS ASK la###labor.net
- DNS ASK se###alabor.net
- DNS ASK la###valley.net
- DNS ASK se####valley.net
- DNS ASK la###sister.net
- DNS ASK se####sister.net
- DNS ASK la###silver.net
- DNS ASK se####silver.net
- DNS ASK ma####almodern.net
- DNS ASK se####lmodern.net
- DNS ASK ma####alproblem.net
- DNS ASK se####lproblem.net
- DNS ASK ma####alanimal.net
- DNS ASK se####lanimal.net
- DNS ASK mo####silver.net
- DNS ASK pr####lylisten.net
- DNS ASK wi####silver.net
- DNS ASK pe####svalley.net
- DNS ASK pe####ssister.net
- DNS ASK se####lvalley.net
- DNS ASK ma####alsister.net
- DNS ASK se####lsister.net
- DNS ASK ma####alsilver.net
- DNS ASK se####lsilver.net
- DNS ASK pr####lylabor.net
- DNS ASK sw###labor.net
- DNS ASK pr####lyvalley.net
- DNS ASK sw###valley.net
- DNS ASK pr####lysister.net
- DNS ASK sw###sister.net
- DNS ASK pr####lysilver.net
- DNS ASK sw###silver.net
- DNS ASK wi####sister.net
- DNS ASK le###labor.net
- DNS ASK po####lelabor.net
- DNS ASK fi####valley.net
- DNS ASK le###sister.net
- DNS ASK fi####sister.net
- DNS ASK le###silver.net
- DNS ASK fi####silver.net
- DNS ASK su####tlabor.net
- DNS ASK wi###rlabor.net
- DNS ASK su####tvalley.net
- DNS ASK su####tsister.net
- DNS ASK su####tsilver.net
- DNS ASK wi###wlabor.net
- DNS ASK pe####slabor.net
- DNS ASK wi####valley.net
- DNS ASK fi###hlabor.net
- DNS ASK la###third.net
Miscellaneous
Creates and executes the following
- 'C:\flppijj\kikhnstkkbrjpwxz5tl.exe'
- 'C:\flppijj\rapxtcg.exe'
- 'C:\flppijj\yocxvxpayw.exe' "c:\flppijj\rapxtcg.exe"
